Advisories · Technology

HashiCorp Vault Enterprise.

Every CVE that names HashiCorp Vault Enterprise among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-89322 CVE record

CVSS 7.2 High

Vault ACL Policy Evaluation May Allow Bypass of Deny Restrictions
- HashiCorp Vault
- HashiCorp Vault Enterprise
- CWE-178
Not analysed yet 7 Oct 2026
CVE-2026-105820 CVE record

CVSS 5.4 Medium

Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
- HashiCorp Vault Enterprise
- Path traversal
Not analysed yet 7 Oct 2026
CVE-2026-105816 CVE record

CVSS 8.0 High

Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft Snapshots
- HashiCorp Vault
- HashiCorp Vault Enterprise
- Path traversal
Not analysed yet 7 Oct 2026
CVE-2026-105818 CVE record

CVSS 5.9 Medium

Vault PKI ACME Issues Certificate With Unvalidated SANs
- HashiCorp Vault
- HashiCorp Vault Enterprise
- CWE-345
Not analysed yet 7 Oct 2026
CVE-2026-5006 CVE record

CVSS 6.8 Medium

Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Policy Paths
- HashiCorp Vault
- HashiCorp Vault Enterprise
- Broken access control
Not analysed yet 24 Aug 2026
CVE-2026-14886 CVE record

CVSS 8.2 High

Vault Enterprise vulnerable to cross-namespace entity deletion
- HashiCorp Vault Enterprise
- Broken access control
Not analysed yet 10 Aug 2026
CVE-2026-12624 CVE record

CVSS 4.3 Medium

Vault vulnerable to LIST authorization bypass via trailing-slash strip
- HashiCorp Vault
- HashiCorp Vault Enterprise
- Broken access control
Not analysed yet 10 Aug 2026
CVE-2026-5051 CVE record

CVSS 4.4 Medium

Audit Log Plugin Directory Guard Bypass via Legacy path Option
- HashiCorp Vault
- HashiCorp Vault Enterprise
- Path traversal
Not analysed yet 1 Jul 2026
CVE-2024-2877 CVE record

CVSS 5.5 Medium

Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node
- HashiCorp Vault Enterprise
- Information disclosure
Not analysed yet 30 Apr 2024
CVE-2023-3775 CVE record

CVSS 4.2 Medium

Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of Service
- HashiCorp Vault Enterprise
- Privilege escalation
Not analysed yet 28 Sept 2023
CVE-2023-3774 CVE record

CVSS 4.9 Medium

Vault Enterprise Namespace Creation May Lead to Denial of Service
- HashiCorp Vault Enterprise
- CWE-248
Not analysed yet 28 Jul 2023
CVE-2023-2197 CVE record

CVSS 2.5 Low

Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM
- HashiCorp Vault Enterprise
- Weak cryptography or TLS
Not analysed yet 1 May 2023